NIS2 KIT · EDITION 2026 · GERMAN OR AUSTRIAN VERSION

NIS2 Compliance Kit

Audit-ready documents for essential and important entities: risk management, reporting processes, registration, evidence. You choose your jurisdiction and receive the version for your country — Germany (German BSI Act, BSIG) or Austria (Austrian NISG 2026).

See packages from EUR 990What is inside →from EUR 990 net per kit · one-time · your jurisdiction (DE or AT)
  • from EUR 990net, pay once
  • EUR 0recurring fees — no subscription
  • 12 monthslegal-status updates included
  • 48 hoursdownload link after receipt of payment (working days)
  • Net prices, business customers only · your files stay usable, nothing gets locked · legal references in the Word and Excel documents checked against EUR-Lex, gesetze-im-internet.de and RIS

ARE WE IN SCOPE?

From 50 employees, NIS2 can apply to you.

In scope are entities in the sectors listed in the annexes to the BSIG (among others energy, transport, health, digital services and manufacturing) above certain sizes: essential entities from 250 employees (or more than EUR 50 million turnover and more than EUR 43 million balance sheet total), important entities already from 50 employees (or more than EUR 10 million turnover and balance sheet total) — § 28 BSIG. In Austria the thresholds of the directive apply through §§ 24, 25 NISG 2026.

Inside the kit: a scope check as a guided checklist — sector, size, special cases — with a legal reference for every criterion.

INSIDE THE KIT

Real documents, not empty outlines.

Word · 21 · German editionIncident response playbookFrom the decision tree “significant incident?” to the final report: the 24-hour, 72-hour and one-month phases, with escalation matrix and contact list. Dummy data, watermark only in the sample. Preview from the German edition; the English edition has the same structure.

The modules

  • Scope & registration — Check, registration guide (§ 33 BSIG / § 29 NISG 2026)
  • Risk management — all ten areas of measures under § 30(2) BSIG / § 32 NISG 2026, each with a template
  • Incident reporting — Processes, forms, contact points for the BSI and the CSIRT
  • Governance — Management obligations & training records (§ 38 BSIG / § 31 NISG 2026)
  • Supply chain — Requirements, questionnaire, contract clauses
  • Evidence — Documentation and evidence structure for the supervisory authority
  • Awareness — Training materials for employees (from the Plus package), e-learning only in the Complete package

More pages from the kit

All documents at a glance (72 documents as Word, Excel and PowerPoint)

00 · START (4)
  • WordQuick Start Guide
  • WordNIS2 Overview
  • WordImplementation Guide
  • ExcelRegulatory Timeline
01 · Scope and Registration (5)
  • ExcelNIS2 Scope Assessment
  • WordRegistration Form Preparation
  • WordSector Classification Evidence
  • WordSubsidiaries and Group Structure
  • WordDORA NIS2 Demarcation Financial Sector
02 · Governance and Management Liability (7)
  • WordBoard Resolution Cybersecurity
  • WordCybersecurity Governance Policy
  • WordManagement Liability Documentation
  • WordManagement Training Plan
  • ExcelManagement Training Record
  • WordCISO Quarterly Report Template
  • ExcelDelegation and Responsibility Matrix
03 · Risk Management and ISMS (4)
  • WordInformation Security Policy
  • WordRisk Analysis Methodology
  • ExcelRisk Assessment Matrix
  • WordRisk Treatment Plan
04 · Incident Management (9)
  • WordIncident Response Policy
  • WordIncident Response Playbook
  • WordEarly Warning 24h Template
  • WordIncident Notification 72h Template
  • WordFinal Report 1 Month Template
  • WordIntermediate Report Template
  • WordSignificant Incident Classification
  • WordReporting Procedure Instruction
  • ExcelIncident Log Register
05 · Business Continuity and Crisis (4)
  • WordBusiness Continuity Policy
  • WordBackup and Recovery Concept
  • WordDisaster Recovery Plan
  • WordCrisis Management and Communication
06 · Supply Chain Security (4)
  • WordSupply Chain Security Policy
  • ExcelVendor Security Questionnaire
  • ExcelVendor Risk Scoring
  • WordCybersecurity Contract Clauses
07 · Secure Development and Vulnerabilities (3)
  • WordSecure Procurement and Development
  • WordVulnerability Management Process
  • WordCoordinated Vulnerability Disclosure Policy
08 · Effectiveness and Audit (2)
  • WordEffectiveness Assessment and Audit Programme
  • ExcelInternal Audit Checklist
09 · Cyber Hygiene and Training (2)
  • WordCyber Hygiene Policy
  • WordInformation Security Training Programme
10 · Cryptography and Access (7)
  • WordCryptography and Encryption Policy
  • WordPersonnel Security Policy
  • WordAccess Control and Authorisation Concept
  • ExcelAsset Inventory
  • WordMFA and Authentication Policy
  • WordSecure Communication Policy
  • WordEmergency Communication Plan
11 · Compliance and Audit Evidence (7)
  • ExcelNIS2 Gap Analysis
  • ExcelStatement of Applicability
  • ExcelEvidence Inventory for Supervisory Authority
  • ExcelCompliance Status Dashboard
  • ExcelAudit Simulation 60 Questions
  • WordPenetration Test RFP
  • WordCyber Insurance Compliance Report
12 · Goodies (5)
  • ExcelISO 27001 NIS2 Gap Mapping
  • ExcelBSI Grundschutz NIS2 Gap Mapping
  • WordFAQ 25 Common Questions
  • WordGlossary NIS2 Terms
  • WordNIS2 Quick Reference Card
13 · Licence (2)
  • WordLicence terms
  • WordVersion History
14 · Training (6)
  • PowerPointManagement Briefing Deck
  • WordManagement Training Script
  • PowerPointCybersecurity Staff Presentation
  • ExcelKnowledge Test
  • WordCertificate of Participation
  • ExcelAnnual Training Plan
15 · SMEs (1)
  • WordSME Light Version

TRAINING PACK · FROM THE PLUS PACKAGE

Two training sessions, ready to deliver.

For the management body: management briefing and training script in seven modules, matching the training obligation under § 38(3) BSIG and § 31 NISG 2026. For all employees: a presentation in eight chapters, covering among other things phishing, passwords and internal reporting channels. Plus a knowledge test, training plan and certificate of participation template. Within the kit, the e-learning is only available in the Complete package.

42slides for all employees
10slides management briefing
7modules in the script for the management body

WHY TWO VERSIONS

Germany is not Austria — your kit knows that.

🇩🇪 Germany — BSIG

  • Risk management § 30(2) BSIG
  • Reports to the joint reporting office of the BSI and the BBK § 32 BSIG
  • Registration § 33 BSIG
  • Administrative fine up to EUR 10 million (particularly important) or EUR 7 million (important); turnover-based amount only above EUR 500 million total turnover § 65 BSIG

🇦🇹 Austria — NISG 2026

  • Risk management § 32 NISG 2026
  • Reports to the CSIRT § 34 NISG 2026
  • Registration § 29 NISG 2026
  • Fine up to EUR 10 million or 2 %, whichever is higher § 45 NISG 2026

That is why your kit comes as one version per country: you buy DE or AT — no mixed “DACH” templates. Every legal reference, every authority and every deadline matches your jurisdiction.

Legal references in the Word and Excel documents checked against the official full texts (EUR-Lex · gesetze-im-internet.de · RIS) — edition 2026, legal status August 2026.

E-LEARNING · IN THE COMPLETE PACKAGE OR STANDALONE

An incident on a Tuesday morning, played through to the report.

Path A for all employees: eight chapters in around 45 minutes. On Tuesday morning, an unknown sign-in from Saturday night is spotted; the course follows the incident through the early warning within 24 hours to the root cause at the IT service provider. Path B for the management body: six chapters in around 35 minutes. German and English in one file, with audio. Runs as a standalone HTML file without installation or as SCORM 1.2/2004 in your LMS. At the end: a final test with 12 questions, pass mark 70 %, and a certificate of participation with verification code.

  • Path A · 8 chapters · approx. 45 min.
  • Path B management body · 6 chapters · approx. 35 min.
  • DE + EN with audio
  • HTML + SCORM 1.2/2004
  • Certificate of participation with verification code
Go to the cybersecurity e-learning

Course page with chapters, duration, certificate of participation and prices

ONE PAYMENT. NOT 36.

What three years look like.

A kit is paid once. Subscription software bills every month for as long as you use it.

Compliance kit1 payment
Subscription software, billed monthly36 payments in 3 years
Schematic without third-party prices: number of payments over 36 months with monthly billing. Cost and term of a subscription depend on the provider.

WHAT YOU GET AND WHAT YOU KEEP

Kit, subscription, law firm or free template.

Compliance kitSubscription softwareLaw firm or consultancyFree template
Paymentonce, from EUR 990 netrecurring, monthly or yearlyfee per engagementEUR 0 purchase price
After the contract endsall files remain usableaccess usually endsas agreedthe template
JurisdictionDE or AT as separate editions; EU AI Act Kit as one EU-wide editionvaries by providerindividualvaries by publisher
Legal reference per statementchecked against EUR-Lex, gesetze-im-internet.de, RIS (Word and Excel documents)varies by providerdepends on the mandatevaries by publisher
Legal-status updates12 months includedincluded in the subscriptionon requestvaries by publisher
TrainingPlus: training pack; Complete: plus e-learningvaries by provideron requestvaries by publisher
Case-by-case legal adviceno — no legal advicenoyesno

The columns describe models, not providers; no third-party prices. Terms: see the terms and conditions.

PACKAGES AND PRICES

Three packages, one kit.

All prices net and one-off. German or Austrian edition, 12 months of legal-status updates included, company licence. Within the kit, the e-learning is only included in the Complete package.

Basic

The documentation

EUR 990

  • 66 documents: folders 00 to 13 and 15, without the training folder
  • Quick Start Guide, scope assessment, board resolution, risk management, reporting templates for 24 hours, 72 hours and one month, supply chain, gap analysis
  • 12 months of legal-status updates
Buy now
Recommended

Plus

Documentation + internal training

EUR 1,390

  • Everything in Basic
  • Training pack: employee presentation, management briefing, training script for the management body, knowledge test, training plan, certificate of participation template
  • Trainer handbook, participant handout and training plan follow as a free update
  • 72 documents
Buy now

Complete

Documentation + training + e-learning

EUR 1,690

  • Everything in Plus
  • Cybersecurity e-learning as an HTML file and SCORM 1.2/2004, with a dedicated path for the management body, company licence for up to 25 users, larger companies on request
  • E-learning within the kit only in the Complete package
  • EUR 190 less than Plus and the standalone course combined (EUR 1,390 + EUR 490)
Buy now
EnthaltenBasicPlusComplete
Documents in folders 00 to 13 and 15✓ enthalten✓ enthalten✓ enthalten
Employee presentation (42 slides) and management briefing (10 slides)– nicht enthalten✓ enthalten✓ enthalten
Training script for the management body (7 modules)– nicht enthalten✓ enthalten✓ enthalten
Knowledge test, training plan, certificate of participation template– nicht enthalten✓ enthalten✓ enthalten
Cybersecurity e-learning as an HTML file and SCORM 1.2/2004, up to 25 users– nicht enthalten– nicht enthalten✓ enthalten
12 months of legal-status updates✓ enthalten✓ enthalten✓ enthalten
Company licence, personalised with company name, logo and licence ID✓ enthalten✓ enthalten✓ enthalten
Price net, one-offEUR 990EUR 1,390EUR 1,690

Payment by card, SEPA direct debit or bank transfer · Invoice with VAT ID · Download link within 48 hours of receipt of payment (working days) · E-learning on its own: from EUR 490 net for up to 25 users; larger companies tiered by company size on request. The Complete package has the same limit of 25 users; more on request.

Licence: one legal entity and its group companies under the licence terms in the kit; further companies or consultant use on request. Done-for-you completion: coming soon. Questions or an individual quote? Write to us via the contact form. Without a VAT ID, please order via the contact form. Contact

UPDATES

Legal-status updates for 12 months — included.

If the legal situation changes, you receive an updated document version by e-mail or download link — for 12 months from delivery. Afterwards, existing customers receive further updates on preferential terms. Your documents stay with you even after the update period (Terms § 8(6)) — nothing is locked, nothing expires.

HONEST LIMITS

What the kit is not.

  • Not legal advice: standardised documentation with legal references, no case-by-case review.
  • Not a certificate: your documentation stays your responsibility — the kit makes it complete and traceable.
  • Not a "DACH" blend: you buy the German or the Austrian version — never a mixture.

THE KIT AT A GLANCE

What you get.

Scope72 documents in 16 folders (00 to 15), 66 of them in the Basic package
FormatsWord (52), Excel (19), PowerPoint (2); e-learning as an HTML file and SCORM 1.2/2004 only in the Complete package
Target groupParticularly important and important entities (in Austria: essential and important entities), above all mid-sized companies from 50 employees or with more than EUR 10 million each in annual turnover and annual balance sheet total
JurisdictionGerman edition (BSIG) or Austrian edition (NISG 2026), you choose when ordering
Legal status17 August 2026, the legal references in the Word and Excel documents checked against the official full texts (EUR-Lex, gesetze-im-internet.de, RIS)
DeliveryDownload link within 48 hours of receipt of payment (working days), personalised with company name, logo and licence ID
LicenceCompany licence for one legal entity and its group companies as set out in the licence terms in the kit
Updates12 months of legal-status updates included; the documents remain usable afterwards

FREQUENTLY ASKED

In short.

What size of organisation is the kit designed for?

For SMEs and mid-sized companies from around 50 employees — the templates scale through placeholders and selection fields from 50 to 1,000+ employees.

How do I buy?

Choose Basic, Plus or Complete, confirm that you are buying as a business and pay by card or SEPA direct debit via Stripe, or by bank transfer against invoice; you receive an invoice with VAT ID. We deliver the personalised kit as a download link within 48 hours of receipt of payment (working days). No subscription. Questions or a custom quote: contact form.

Is the kit kept up to date when the law changes?

Yes — for 12 months from delivery you receive updated document versions when relevant law changes. Afterwards, existing customers receive further updates on preferential terms; the delivered documents stay with your company permanently: perpetual right of use, no lock, no account.

Germany or Austria — what do I get?

You choose your jurisdiction when ordering and receive the version for your country. There is deliberately no mixed "DACH" version.

Does the kit replace legal advice?

No. The kit is standardised compliance documentation with legal references — no advice on your individual case. For the final sign-off we recommend a review by your legal counsel where needed.

Legal basis and status

Legal status of the documents: 17 August 2026. The basis is Directive (EU) 2022/2555 (NIS2). In Germany, the BSI Act (BSIG) applies, adopted as Article 1 of the NIS2 Implementation Act (NIS2UmsuCG) (BGBl. 2025 I No. 301) and in force since 6 December 2025. In Austria, the NISG 2026 (BGBl. I No. 94/2025) applies, whose obligations have applied since 1 October 2026. The legal references in the Word and Excel documents have been checked against the official full texts. Standardised documentation, not legal advice for individual cases.

Publisher: Ens Naturale e.U., Vienna (compliance-kit.eu). Page last updated: 13 October 2026.